De-duplication in billing system

ABSTRACT

A computing system partitions received events into a number of channels by account identifier. The channels receive the events and perform de-duplication of the events. This de-duplication can be performed with a filter that is updated to reflect the receipt of any original event. The filter may be used to either determine that the event is not a duplicate of another, or to determine that the event cannot be ruled out as being a duplicate of another. In the latter case, further processing may be performed to for definitively determine whether the event is truly a duplication, or in the alternative, the event may be immediately treated as a duplicate.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.12/785,313, filed on May 21, 2010, and entitled “DE-DUPLICATION INBILLING SYSTEM,” which application is expressly incorporated herein byreference in its entirety.

BACKGROUND

When a consumer and a provider engage in a contract for goods and/orservices, the provider typically creates an account that is associatedwith a specific consumer for the duration of the relationship betweenthe provider and that consumer. An account is especially useful wherepayment is not necessarily made at the time the goods were received, orat the time that the service was rendered (such as when payment is madein advanced or payment is made in arrears). As goods are delivered, oras services are rendered, a balance in the account changes to reflect anobligation under the contract for the consumer to pay the provider.Ongoing accounts are typically periodically subjected to a billingcycle, in which the consumer is notified of the balance on the account,and is given a period of time within which to make payment, if someamount is owed. A typical billing cycle is monthly (e.g., in the case ofcredit cards, mortgage payments, utility bills), but billing cyclesmight also be quarterly, weekly, annually, or perhaps sporadic andunpredictable. Billing cycles may also be triggered by accumulatedresource usage or monetary balance or other events. Web services may bebroadly construed as being any service that is offered over theInternet, though Web services may also be offered over other networks ordelivery mechanism Web services may also be a charged for, in somecases.

The process of maintaining an accurate account balance for consumers canbe a major part of the operational complexity for a provider. A singleprovider may have accounts set up with thousands, or even millions, ofconsumers depending on the success of the provider's business. Thus, asingle provider typically tracks account balances for each consumer. Inaddition, for each individual account, there may be particular eventsthat result in a change in the account balance. For even a singleaccount, there may be hundreds or even thousands of events that eachresult in a change in the account balance, or which are to be tracked sothat the ultimate account balance may be calculated at the end of thebilling cycle.

BRIEF SUMMARY

At least one embodiment described herein relates to the handling ofevents that affect one or more accounts. A computing system receives anumber of events in the form of event messages, each of the eventshaving potentially some impact on one or more accounts. The computingsystem partitions the messages as they are received into one of a numberof channels. For instance, each channel might be allocated a particularrange of account identifiers. In that case, all events related to aparticular account within a range of accounts managed by a channel, willbe forwarded to that channel.

At least one, and perhaps all, of the channels receive the events andperform de-duplication on at least some, and perhaps all, of thereceived events. The de-duplication may be performed with the assistanceof a Bloom filter. By comparing the event identifier against the Bloomfilter, the channel may either determine that the event is not aduplicate of another received by the channel, or determine that theevent cannot be ruled out as being a duplicate of another received bythe channel. In the latter case, the channel may take subsequent actionbased on the determination that the event cannot be ruled out as being aduplicate. For instance, the channel may summarily treat the event as aduplicate, or perhaps may continue to perform other processing to try toget a more definitive conclusion as to whether the event is truly aduplicate.

This Summary is not intended to identify key features or essentialfeatures of the claimed subject matter, nor is it intended to be used asan aid in determining the scope of the claimed subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and otheradvantages and features can be obtained, a more particular descriptionof various embodiments will be rendered by reference to the appendeddrawings. Understanding that these drawings depict only sampleembodiments and are not therefore to be considered to be limiting of thescope of the invention, the embodiments will be described and explainedwith additional specificity and detail through the use of theaccompanying drawings in which:

FIG. 1 illustrates an example computing system that may be used toemploy embodiments described herein;

FIG. 2 illustrates an example event data structure;

FIG. 3 illustrates an environment in which events may be generated;

FIG. 4 illustrates a flowchart of a method for handling events;

FIG. 5 illustrates an environment in which events may be processed;

FIG. 6 illustrates a Bloom filter environment that may be used toperform de-duplication; and

FIG. 7 illustrates a computing environment that uses a time-orderedidentifier index.

DETAILED DESCRIPTION

In accordance with embodiments described herein, the handling of eventsthat affect one or more accounts is described. A computing systempartitions received events into a number of channels, perhaps by accountidentifier. The channels receive the events, and perform de-duplicationof the events. This de-duplication may be performed using a Bloom filterthat is updated to reflect the receipt of any original event. The Bloomfilter may be used to either determine that the event is not a duplicateof another, or to determine that the event cannot be ruled out as beinga duplicate of another. In the latter case, further processing may beperformed to definitively determine whether the event is truly aduplication, or in the alternative, the event may be immediately treatedas a duplicate. First, some introductory discussion regarding computingsystems will be described with respect to FIG. 1. Then, embodiments ofthe scalable billing will be described with respect to FIGS. 2 through7.

As an initial matter, the terms “first”, “second” and so forth are usedin the claims merely to distinguish one item from another and should notbe construed as implying any sequential or positional ordering. Forinstance, in the claims, a “first event” should not be construed asintending that the event is the first event ever handled by the system.The term “first event” is used to merely distinguish that event fromanother event termed a “second event” in accordance with standard claimlanguage construction.

Computing systems are now increasingly taking a wide variety of forms.Computing systems may, for example, be handheld devices, appliances,laptop computers, desktop computers, mainframes, distributed computingsystems, or even devices that have not conventionally considered acomputing system. In this description and in the claims, the term“computing system” is defined broadly as including any device or system(or combination thereof) that includes at least one processor, and amemory capable of having thereon computer-executable instructions thatmay be executed by the processor. The memory may take any form and maydepend on the nature and form of the computing system. A computingsystem may be distributed over a network environment and may includemultiple constituent computing systems.

As illustrated in FIG. 1, in its most basic configuration, a computingsystem 100 typically includes at least one processing unit 102 andmemory 104. The memory 104 may be physical system memory, which may bevolatile, non-volatile, or some combination of the two. The term“memory” may also be used herein to refer to non-volatile mass storagesuch as physical storage media. If the computing system is distributed,the processing, memory and/or storage capability may be distributed aswell. As used herein, the term “module” or “component” can refer tosoftware objects or routines that execute on the computing system. Thedifferent components, modules, engines, and services described hereinmay be implemented as objects or processes that execute on the computingsystem (e.g., as separate threads).

In the description that follows, embodiments are described withreference to acts that are performed by one or more computing systems.If such acts are implemented in software, one or more processors of theassociated computing system that performs the act direct the operationof the computing system in response to having executedcomputer-executable instructions. An example of such an operationinvolves the manipulation of data. The computer-executable instructions(and the manipulated data) may be stored in the memory 104 of thecomputing system 100. Computing system 100 may also containcommunication channels 108 that allow the computing system 100 tocommunicate with other message processors over, for example, network110.

Embodiments of the present invention may comprise or utilize a specialpurpose or general-purpose computer including computer hardware, suchas, for example, one or more processors and system memory, as discussedin greater detail below. Embodiments within the scope of the presentinvention also include physical and other computer-readable media forcarrying or storing computer-executable instructions and/or datastructures. Such computer-readable media can be any available media thatcan be accessed by a general purpose or special purpose computer system.Computer-readable media that store computer-executable instructions arephysical storage media. Computer-readable media that carrycomputer-executable instructions are transmission media. Thus, by way ofexample, and not limitation, embodiments of the invention can compriseat least two distinctly different kinds of computer-readable media:computer storage media and transmission media.

Computer storage media includes RAM, ROM, EEPROM, CD-ROM or otheroptical disk storage, magnetic disk storage or other magnetic storagedevices, or any other medium which can be used to store desired programcode means in the form of computer-executable instructions or datastructures and which can be accessed by a general purpose or specialpurpose computer.

A “network” is defined as one or more data links that enable thetransport of electronic data between computer systems and/or modulesand/or other electronic devices. When information is transferred orprovided over a network or another communications connection (eitherhardwired, wireless, or a combination of hardwired or wireless) to acomputer, the computer properly views the connection as a transmissionmedium. Transmissions media can include a network and/or data linkswhich can be used to carry desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer. Combinationsof the above should also be included within the scope ofcomputer-readable media.

Further, upon reaching various computer system components, program codemeans in the form of computer-executable instructions or data structurescan be transferred automatically from transmission media to computerstorage media (or vice versa). For example, computer-executableinstructions or data structures received over a network or data link canbe buffered in RAM within a network interface module (e.g., a “NIC”),and then eventually transferred to computer system RAM and/or to lessvolatile computer storage media at a computer system. Thus, it should beunderstood that computer storage media can be included in computersystem components that also (or even primarily) utilize transmissionmedia.

Computer-executable instructions comprise, for example, instructions anddata which, when executed at a processor, cause a general purposecomputer, special purpose computer, or special purpose processing deviceto perform a certain function or group of functions. The computerexecutable instructions may be, for example, binaries, intermediateformat instructions such as assembly language, or even source code.Although the subject matter has been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the subject matter defined in the appended claims is notnecessarily limited to the described features or acts described above.Rather, the described features and acts are disclosed as example formsof implementing the claims.

Those skilled in the art will appreciate that the invention may bepracticed in network computing environments with many types of computersystem configurations, including, personal computers, desktop computers,laptop computers, message processors, hand-held devices, multi-processorsystems, microprocessor-based or programmable consumer electronics,network PCs, minicomputers, mainframe computers, mobile telephones,PDAs, pagers, routers, switches, and the like. The invention may also bepracticed in distributed system environments where local and remotecomputer systems, which are linked (either by hardwired data links,wireless data links, or by a combination of hardwired and wireless datalinks) through a network, both perform tasks. In a distributed systemenvironment, program modules may be located in both local and remotememory storage devices.

The principles described herein provide an efficient mechanism forhandling events that have an impact on billing accounts. Prior todescribing the handling of events, the content of events will bedescribed with respect to FIG. 2, which illustrates an example eventdata structure 200. Then, an environment in which the events may begenerated will be described with respect to the event generationenvironment 300 of FIG. 3. Then, the handling of the events inaccordance with an example embodiment will be described with respect toFIGS. 4 and 5.

FIG. 2 illustrates an example event data structure 200. The datastructure is just an example and is provided primarily to illustratesthe types of information that might be present in an event that affectsan account for which a consumer may be billed.

The event data structure 200 may include a unique event identifier 201that is perhaps unique across all events, or at least is unique across asubset of events over which duplication checking occurs. A descriptionof duplicate checking is deferred until further in this description withrespect to FIGS. 6 and 7.

The event data structure 200 may also include such information as anaccount identifier 202, a customer identifier 203, a provider identifier204, an event time 205, an event description 206, and auxiliaryinformation 207. An account is formulated based on a contractualobligation entered into between a customer and a provider. According toa typical contract, the customer is obligated to pay a certain amount inexchange for the provider providing a particular good or service. As theobligations to pay accumulate, an account balance is altered toincrementally reflect the obligation. The account balance might also becontractually affected by, for example, late fees, refunds, credits,discounts, and the like in accordance with the contract, and inaccordance with non-contractual business practice.

The account identifier 202 may be an account identifier recognized bythe customer and provider, or may be some other identifier recognized bythe billing system described herein.

The customer identifier 203 identifies the customer of the account.However, the event itself need not contain the customer identifier 203since that may later be inferred based on, for example, the accountidentifier 202.

The provider identifier 204 identifies the provider of the good orservices. Once again, the event itself need not contain the provideridentifier 204 since the provider may also be later inferred based on,for example, the account identifier 202.

The event time 205 may specify the time that the action underlying theevent occurred, and/or the time that the event was generated. The timeof the event might have an impact on billing. For example, a telephonecall placed at a particular time might be more or less expensivedepending on the time that the call was placed. The event time may alsohelp in sequencing the event as described hereinafter.

The event description may describe the action description 206 thatdescribes the action that underlies the event, and that may have someimpact on billing. For instance, an e-mail service might charge acertain amount per received e-mail. A phone service might charge acertain amount per received call. An internet service might charge acertain amount per minute of online activity, or a certain amount perunit data communicated over the internet service. Any action that mighthave an impact on billing may thus generate an event. For actions thatendure for a period of time (e.g., a telephone call), perhaps the eventis generated only upon completion of the action, and might specify aduration. For instance, the action description might indicate “phonecall—24 minutes”. An event might also be generated at the start of theduration and at the end of the duration, with the events correlated andinterpreted together from which a duration may be inferred. Duration maybe also based on events such as the consumption of a certain quantity ofstorage in the case of a storage service.

Auxiliary information 207 may include any other information that mightbe helpful in determining billing information for the correspondingaccount.

FIG. 3 illustrates an environment 300 in which events may be generatedand delivered to the billing system illustrated and described withrespect to FIGS. 4 and 5. The principles described herein are notlimited to any particular environment 300 for generating billing eventsand delivering such billing events to a billing system. However, theenvironment 300 is provided as an example only.

The environment 300 includes two services 301 and 302 that areillustrated as examples only. The principles provided herein may operatewhere there is only one service, or in which there are many services. Asan example, perhaps service 301 is an IP-based telephone service.Perhaps service 302 is an e-mail service. However, the principlesprovided herein are not limited to the type of service. For instance,the principles may operate with stock and mutual fund brokerageservices, real estate transaction services, internet access services,online store services, utility providers, or any other service thatprovides goods or services. The service may have a physical component(e.g., a landscaper service may perform landscaping for a customer'sproperty), but the illustrated service represents an electronicrepresentation of the service (e.g., upon completing a lawn service, thelawn service provider may report the service performed to a softwaremodule).

Each service may have one or more usage sources that monitor the servicefor particular activities that might affect billing. Each usage sourcemay operate independently of the other. For instance, service 301includes a single usage source 311, while the service 302 includesmultiple usage sources 321, 322 and 323. There is no limit to the numberof usage sources that may be assigned to a particular service. Thenumber will depend on the designer's preference, and on the nature ofthe service. For instance, if the service 301 is an IP-based telephoneservice, perhaps only one usage source is used that simply trackstelephone calls. If the service 302 is an e-mail service, there might bemultiple activities that could affect billing. For instance, service 321might track when an e-mail is sent, service 322 might track when ane-mail is received, and service 323 might track when a particular unitsize of data is transferred. This might be helpful in a situation whenbilling depends on the number of e-mails received, the number of e-mailssent, and the total data transferred.

As each usage source 311, 321, 322 and 323 detects an activity that itis configured to detect, the usage source generates and dispatches anevent that describes the activity. Alternatively or in addition, theusage source might buffer events when they are generated, so that theevents can be dispatched in batches. The billing system may placeconstraints on the number of or time periods over which events aredelayed due to batching. An example of the structure and content of suchevents has been described with respect to FIG. 2. The events aredispatched over a network 330, an example of which being the Internet,whereupon they are received at various routing components 501, 502 and503 of FIG. 5. In one embodiment, the routing components 501, 502, 503are each instances of the same routing component class.

FIG. 4 illustrates a flowchart of a method 400 for handling the events.Some of the acts of the method may be performed by the routing system ofFIG. 5 (listed under the heading “Router”) noting that the “routingsystem” may be distributed and include multiple independent routers.Some of the acts may be performed by the routers 501, 502 and 503 ofFIG. 5. Some of the acts may be performed by the aggregators 530 of FIG.5 (listed under the heading “Aggregator”). The method 400 may beperformed for each event received, and will be described with respect tothe event handling environment 500 of FIG. 3.

Referring to FIGS. 4 and 5, and as previously described, the events arereceived (act 411) at one of the routing components 501, 502 or 503.While there may be a single routing component, multiple routingcomponents are illustrated as there may be a high volume of events beingreceived and that are to be routed. The routing components 501, 502, 503may be stateless, and may, for example, acknowledge receipt of theevents to the respective usage source. In one embodiment, multipleevents may be dispatched as a collective message from the usage source,each event perhaps associated with a different account. In that case,the routing components also extract each event from the message, anddispatch each individual event through the full-mesh network 510.

Each router partitions the events as they are received to one ofmultiple channels 520 (act 412). In other words, the router decideswhich event is to be dispatched to which channel. The principlesdescribed herein are not limited to the criteria by which the events arepartitioned. However, one example of how they might be partitioned is bygeography. For instance, a channel might be responsible for all eventswhose underlying triggering action occurred within certain geographicalboundaries. Alternatively, a channel might be responsible for all eventswhose customer or provider is situated within certain geographicalboundaries. In one embodiment, the events are partitioned in a mannerthat attempts to apply a uniform distribution of load across theindividual channels.

However, one mechanism for partitioning does the partitioning on thebasis of the account identifier associated with the event. For instance,each of the channels 520 may be responsible for handling all eventswhose account identifier falls within a corresponding range. Thus, uponreceiving an event, the router 510 might read the account identifier,identify which range the identifier falls in, identify the correspondingchannel that is to handle the event, and dispatch the event to thatchannel for further handling.

Referring to FIG. 5, the channels 520 include seven channels 521 through527. However, the principles described herein are not limited to thenumber of channels. There may be as few as one, but perhaps may also beas many as a thousand channels, or even millions of channels, dependingon what the computing system is capable of handling, and what makes mostsense from a design perspective. In one embodiment, a larger number ofchannels is used to allow for more flexibility to re-distribute loadacross physical hardware.

In this example, suppose that channel 523 receives the event. Referringback to FIG. 4, the channel checks that the event is not a duplicate ofanother event received by the channel (act 421). If it is a duplicate,then the event is discarded or at least not processed further. Perhapsthe duplicate is logged so that the effectiveness of the de-duplicationprocess may be evaluated or to detect failures in other parts of thesystem, but the duplicate event is not permitted to affect billing sincedoing so would result in a customer perhaps being double billed for thesame action.

The principles described herein are not limited to the manner in whichde-duplication is performed. In one embodiment, the de-duplication isperformed by checking the event identifier against a list of eventidentifiers already received. To keep that list from growing too large,perhaps the list of event identifiers are kept on a some time-boundbasis (such as daily), and when the list becomes a certain age (perhapsa week old), the list is discarded or not checked further. Theassumption there is that any duplicate would be received fairly shortlyafter the original event was received. A primary cause for duplicatemessaging may be that the sender of an event re-sends an event when itdoes not receive acknowledgement due to transient network problems. Butperhaps the receiver of the event did receive the event, but theacknowledgement simply was lost in transmission back to the sender ofthe event.

Once de-duplication is performed, the channel is dealing with onlyoriginal events, with no duplicates. At this stage, the channel maysequence the events with a channel-specific sequence number (act 422).The channel might also append its channel identifier to the event datastructure so that components that subsequently handle the message (suchas the aggregator to be described further below) may understand whatchannel handled the event, and which channel the channel-specificsequence number correlates to. The event is then dispatched to thecorresponding aggregator for that channel.

Referring to FIG. 5, the event handling environment 500 includesaggregators 530. In the illustrated case, there are two aggregators 531and 532. However, the principles described herein are not limited to thenumber of aggregators. The purpose of the aggregators is to aggregatethe billing data received from the event for each account, and presentthe aggregated data in better form for consumption by the billingalgorithm that determines how the aggregated data should affect theaccount balance for each account. In this embodiment, one or morechannels are assigned to each aggregator. For instance, channels 521 and522 provide their events to the aggregator 531, while the channels 523through 527 provide their events to the aggregator 532. The channels 520and aggregators 530, while performing different functions, may (but neednot) be implemented on the same physical or virtual machine.

When the event is received, however, the aggregator may do anotherde-duplication as there may be conditions between the channel and theaggregator that may give rise to the regeneration of duplicates. Forinstance, perhaps there is reliable messaging between the channel andthe aggregator. In that case, the channel or another intermediarybetween the channel and aggregator might generate a duplicate if it doesnot receive an acknowledgement, even though an acknowledgement mighthave been sent.

However, de-duplication is a more efficient task given that there arechannel-specific sequence numbers assigned to the event. Thus, theaggregator performs de-duplication (act 431) by tracking a water mark inthe sequence number for the corresponding channel, the water mark movingin a movement direction that is the same as that of the sequence numberassignment. For instance, the channel might assign a sequence number inthe ascending direction in which case the water mark is only increased,and any event received that is lower than the high water mark can beassumed to be a duplicate. For instance, if the channel assigned asequence number of 15 to the prior event, the channel would assign asequence number of 16 to the subsequent event.

The aggregator receives events and tracks the high water mark for thesequence number for each channel (in the case in which the sequencenumber is assigned in the ascending direction). When a subsequent eventis received by the aggregator, the aggregator reads the channel-specificsequence number for that event, reads the channel identifier for thechannel that handled the event, and compares that sequence numberagainst the channel-specific water mark for that channel. If thechannel-specific sequence number is less than the high water mark, theevent is treated as a duplicate, and not factored into the aggregationand billing processes.

If the channel-specific sequence number is greater than the high watermark, and the channel-specific sequence is just one higher than theprevious high water mark for that channel, then the channel's high watermark is incremented by one, and the event is accepted as an originalevent, and not a duplicate of another.

If the channel-specific sequence number is greater than the high watermark, and the channel-specific sequence number is more than one higherthan the previous high water mark for that channel, then processingmight depend on how important those intervening events are to thebilling process. For example, suppose the channel-specific high watermark was 15, when an event with a channel-specific sequence number of 18is received. That would mean the two events assigned withchannel-specific sequence numbers of 16 and 17 have not been received.If those events are important to the billing process, then perhapsprocessing of the event with the sequence number of 18 is delayed for amoment in anticipation of the intervening two events. If those eventsare not anticipated to be important to the billing process, perhaps thehigh water mark is adjusted to 18, knowing that if and when the otherintervening events (having sequence numbers 16 and 17) are received,those events will be discarded as presumed duplicates even though theyare not actually duplicates of another event received by the aggregator.

A similar process may be performed if a channel assigns a decrementingsequence number to an event or any other ordering of identifiers. Forexample, in the case of a decrementing sequence number ordering, thechannel-specific sequence number will be compared against a low watermark, with the water mark being adjusted downwards as new events arereceived from the channel.

Once the aggregator is confident that a received event is not aduplicate of another previously received event, the aggregator thenaggregates the event received from the channel (act 432). Aggregationinvolves receiving multiple events for an account, and interpreting themultiple events to formulated aggregated data represents the results ofevaluation of multiple events. The aggregated data may then be moreeasily consumed by the billing algorithm.

As an example, an aggregator may sum parameters from multiple events fora given account. For instance, the aggregator may, one a weekly basis,sum all of the phone call minutes that occurred during prime callingperiods, and separately sum all of the phone call minutes that occurredoutside the prime calling periods. These two sums may then be presentedas aggregated data on a weekly basis to the billing algorithm. Othertypes of summing might involve counting the number of e-mails sent andreceived from events that indicate that an e-mail was sent, or eventsthat indicate that an e-mail was received.

Aggregation may involve more than just incrementing or summing, but mayapply any type of aggregation that is useful for the billing process.For instance, the aggregator may average parameters from multiple eventsfor an account, or perhaps find a minimum or maximum of a parameter frommultiple events for an account. A billing function may then calculatethe bill for the account based on the aggregated data. For example,there might be a flat fee arrangement for a certain number of unitsused, with potentially a fee per unit used thereafter. There might alsobe discounts offered that the billing function takes into consideration,where the discount depends on the meeting of one or more preconditions.There might also be functions that consider the maximum number of unitsused for a given period, and so forth.

In an alternative embodiment, de-duplication is performed at theaggregator without the channel having previously performed channel-basedsequencing. In that case, the aggregator would not rely on anychannel-based sequencing, but may instead perform de-duplication in amanner that does not rely on any such sequencing. In another embodiment,there might be some channels that perform sequencing, and some that donot. In that case, the aggregator may choose to performingde-duplication based on the channel-based sequencing if available, orperform de-duplication without relying on sequencing when suchsequencing is not available.

Example processes for performing de-duplication in the absence of achannel-specific sequence number will now be described in furtherdetail. Such de-duplication may be performed at the channel, or perhapsat the aggregator. In one embodiment, a Bloom filter is used todetermine whether or not an event is a duplicate of another alreadyreceived. While a single Bloom filter might be used for this purpose, aBloom filter might be used for given periods of time. For example,suppose that events are checked against previous events received overthe past seven days. In that case, it might be more efficient to set upa Bloom filter on a daily basis. Then, as time passes, and a Bloomfilter is no longer relevant because the filter corresponds to eventsreceived on a particular day that falls outside of the window (e.g., isnot within the 7 most recent days), the Bloom filter may simply bediscarded.

FIG. 6 illustrates a Bloom filter environment 600 that includes anincoming event 601, a Bloom filter 610, a Bloom filter checker 611 and aBloom filter updater 612. As previously mentioned, the incoming event601 will include a unique identifier that uniquely identifies an eventin a manner that is unique at least within a channel, and is preferablyglobally unique. Initially, as a Bloom filter is set up at the beginningof a particular day, the Bloom filter is simply a bit sequence with allbits being reset to a binary zero.

As each event (such as event 601) is received, the event identifier isinput into one or more hash algorithms in the Bloom filter checker. Theresult will be a set of corresponding bit addresses that should be setto one in the Bloom filter. The Bloom filter checker 611 verifieswhether or not the corresponding bits are already set to one in theBloom filter 610.

If not all of the corresponding bits are set to one, this means that anevent with that same unique identifier has not been processed by theBloom filter updater 612. Thus, the event may definitively be determinednot to be a duplicate of a prior event. In that case, the Bloom filterupdater 612 sets the corresponding bits of the Bloom filter to one,evidencing the receipt of the event.

On the other hand, if all of the corresponding bits are set to one, thismeans that an event with that same unique identifier might have beenprocessed by the Bloom filter updater 612. However, this cannot beconclusively determined. After all, it is possible that a combination ofevents with different unique identifiers just happen to set thecorresponding bits to one, rather than having a prior event with thesame unique identifier cause the corresponding bits to be set to one.

At this stage, if all of the corresponding bits are set to one, then thede-duplication process may perform a number of processes that mayperhaps depend on how important it is that non-duplicate events not bethrown out. For instance, for events that have lesser impact on billing(e.g., on the order of a few pennies), it might not be worthwhile toperform further processing to conclusively determine that the event is aduplicate. Instead, the Bloom filter checking may be sufficient (if thecorresponding bits are set to one) to estimate within a reasonableprobability that the event may be a duplicate of another sufficient towarrant throwing out the event.

For more valuable events, however, perhaps further processing may beperformed to make a better estimate on whether the event is a duplicateof another. For instance, perhaps at this point, if the Bloom filterprovides a positive match of the corresponding bits, the de-duplicationmechanism actually does a comparison of the unique identifier for thecurrent event against the unique identifiers for prior events that havebeen received by the channel within a given time period (e.g., perhapsseven days). While the de-duplication mechanism might perform this checkagainst prior identifiers in a random fashion, the de-duplication wouldbenefit by having some structure to this checking process that increasesthe chance that an identifier match may be found sooner.

FIG. 7 illustrates a computing environment 700 that uses a time-orderedidentifier index 710. The time-ordered identifier index 710 orders theevents first by time, and second by identifier. The use of atime-ordered identifier index 710 may more quickly result in a match ofidentifiers when duplicate events have a tendency to be received closelyin time. For instance, a duplicate event might be received only a fewseconds after the original event was received. This might be caused byreliability mechanisms in the messaging channel in which the event wastransmitted. If the origin of the event or an intermediate node in thechannel does not receive a confirmation of receipt by the next node inthe channel, the node might retransmit a copy of the event untilconfirmation is received. Sometimes, this retransmission might occur inonly a matter of seconds or a fraction of a second. Thus, duplicateevents may be received within seconds of the original events.

In the time-order index environment 700, when an event 701 is received,the date/time field of the event is checked. In good likelihood, theevent 701 is a recent event, and the section 711 of event identifiersfrom the index 710 corresponding to that time may likely be already inmemory. If not, the section 710 of the time-ordered index 710corresponding to that time may be loaded into memory. If the event is aduplicate event, the identifier may more likely be found in the section711 corresponding to this time. If not, the next most recent section maybe loaded and so forth. Since the index 710 is time-order, this may bemore easily accomplished by simply loading sequentially one indexsection at a time, until the duplicate is found. Thus, event duplicatesmay more quickly be found that by a method of simply randomly checkingevent identifiers for all events received over the last seven days.

If the event was a not a duplicate, even though the Bloom filterreturned a false positive match, then this mechanism would result in allseven days of time-ordered indexes being checked. This could be overlytime-consuming given the value of the event. Accordingly, the amount oftime over with the time-ordered index is checked may depend on the valueof the event. For instance, for some events of lesser value, even thoughfurther checking beyond the Bloom filter was warranted, the event maystill not be of sufficient value to warrant checking more than one hourof the time-ordered index. Higher value events may warrant checking oneor two days of the time-ordered index. Maximum value events may warrantchecking all seven days of available time-ordered indexes. If nothing isfound in the time-ordered index after a complete check of seven days,then the event may be determined not to be a duplicate, and furtherprocessed. If nothing is found in the time-ordered index after a checkof a lesser period in the time-ordered index, then the event may beassumed to be a duplicate (since a complete check was not performed overall substantial possibilities of possible receipt times of the priororiginal event).

The use of the time-ordered index may be used to further check forduplicates for which the Bloom filter resulted in a positive duplicateestimation. This results in fewer number of reads from the time-orderedindex because 1) the use of the Bloom filter will eliminate the need touse the time-ordered index for most (and potentially a substantiallymajority) of the events received, and 2) even when the Bloom filterindicates a positive determination for a duplication, the use of thetime-ordered index will more likely result in the duplicate being foundearly, perhaps using the sections of the index that are already inmemory. Thus, the use of the time-ordered index following a Bloom filtercheck improves efficiency in read operations.

To improve efficiency in write operations, updates of the Bloom filterand updates of the time-ordered index may be batched. For instance, forBloom filter updates, if an event is determined not to be a duplicate ofanother, rather than the corresponding bits being used to immediatelyupdate the Bloom filter, corresponding bits for further events areawaited. Once the corresponding bits for a number of events (e.g., onehundred) are queued up, the system might then persist the bit changes inthe Bloom filter. In order to provide some security against unintendedsystem failure, the system might use versioning so as to be able to tellthe difference between those bits that were set in response to priorevents that have been persisted in the Bloom filter, and those bits thatshould be set in response to prior events that have not yet beenpersisted in the Bloom filter. Thus, upon restarting the system after afailure, the queue may be repopulated with the corresponding bits. Inthe case of the use of a queue, not only would the persisted version ofthe Bloom filter be checked, but also the corresponding bits that arequeued to be set, to determine whether all of the corresponding bits ofthe event are set.

For a time-ordered index, once again, a number of time-orderedidentifier write operations may be queued. Once the queue has reached acertain size (e.g., after a hundred identifier write operations havebeen queued), the queue may be written to the time-ordered index therebypersisting the event receipts. Once again, versioning may be used todetermine, after a system shutdown, which time-ordered identifies werepersistent already in the time-ordered index, and which time-orderedidentifiers were waiting to be persisted.

Through batching of such write operations, the number of writeoperations may be substantially reduced thereby improving systemefficiency. Delete operations may also be batched. For instance, perhapsif there is a daily Bloom filter, then the Bloom filter is deleted atone point during the day in which the Bloom filter because stale (e.g.,becomes more than seven days old). Likewise, the time-ordered indexesmay be partitioned by time, such that older partitions may be easilydeleted in one batch, rather than deleting one identifier at a time.

The reduction of read operations, write operations and delete operationsis important for scaling the de-duplication so that a large number ofevents may be processed. The use of the Bloom filter is also beneficialas it removes a large number of events from having to undergo furtherde-duplication, because most events would be quickly be determined notto be duplicates of another. In some cases, perhaps Bloom filterchecking is all that is done, such that any event that is positivelyestimated to be a duplicate through the Bloom filter checking (even if afalse positive estimation) is treated as though it is a duplicate. Thiswould result in some possible lost billing opportunity, but wouldeliminate the chance of double billing.

This de-duplication may be performed in the corresponding channel, or inthe alternative embodiment may be performed at the aggregator at thetime of aggregation. Thus, an efficient mechanism for processing eventsthat have an impact on billing have been described.

The present invention may be embodied in other specific forms withoutdeparting from its spirit or essential characteristics. The describedembodiments are to be considered in all respects only as illustrativeand not restrictive. The scope of the invention is, therefore, indicatedby the appended claims rather than by the foregoing description. Allchanges which come within the meaning and range of equivalency of theclaims are to be embraced within their scope.

What is claimed is:
 1. A computer-implemented method for performingde-duplication of incoming events, the method comprising: an act of acomputing system receiving a plurality of events in the form of eventmessages, each of at least some of the events affecting one or more of aplurality of accounts; an act of the computing system partitioning eachof the plurality of events into a plurality of channels, each of theplurality of channels receiving a subset of the plurality of events; andfor at least one of the plurality of channels, performing de-duplicationfor at least some of the events received by the corresponding channel,wherein de-duplication comprises: determining, based at least in part onthe event identifier of the first event, that the first event cannot beruled out as being a duplicate; identifying a value of the first event;and an act of taking subsequent action, which is directed at determiningwhether the first event is a duplicate, based upon both of (1) thedetermination that the first event cannot be ruled out as being aduplicate, as well as (2) the value of the first event, wherein thesubsequent action comprises a first combination of processes when thevalue of the first event is less than a predetermined threshold, andwherein the subsequent action comprises a second combination ofprocesses that is different than the first combination of processes whenthe value of the first event is greater than a predetermined threshold.2. The method of claim 1, wherein the act of taking subsequent actioncomprises: an act of treating the first event as a duplicate.
 3. Themethod of claim 2, wherein the act of treating the first event as aduplicate comprises: an act of deleting the first event.
 4. The methodof claim 2, wherein the act of treating the first event as a duplicatecomprises: an act of logging detection of a duplicate; and using thelogged detection of the duplicate to evaluate a failure associated withthe de-duplication.
 5. The method of claim 1, wherein the act of takingsubsequent action comprises: an act of searching identifiers for eventspreviously received by the channel until a duplicate identifier is foundcorresponding to the identifier of the first event.
 6. The method ofclaim 5, wherein the act of searching identifiers for events previouslyreceived by the channel comprises: an act of searching a time-orderedidentifier index that contains an index of identifiers of previouslyreceived events ordered by time.
 7. The method of claim 1, wherein themethod includes an act of comparing the event identifier for a firstevent against a first filter to determine that the first event cannot beruled out as being a duplicate of another event previously received bythe channel.
 8. The method of claim 7, wherein de-duplication furthercomprises: an act of comparing an event identifier for a second eventagainst the first filter to determine that the second event is not aduplicate of another event received by the corresponding channel; inresponse to determining that the second event is not a duplicate ofanother event, an act of updating the first filter to reflect receipt ofthe second event, wherein the second event may be received by thechannel before or after the first event.
 9. The method of claim 8,wherein the act of updating the first filter to reflect receipt of thesecond event is performed in a batch as part of an act of updating thefirst filter to reflect receipt of a plurality of events.
 10. The methodof claim 1, wherein the act of performing de-duplication in thecorresponding channel comprises: an act of further partitioning thereceived events into a plurality of partitions within the correspondingchannel, prior to performing the act of de-duplicating the receivedevents.
 11. A computer storage device having stored computer-executableinstructions that, when executed by one or more processors of acomputing system, cause the computing system to perform a method thatincludes: an act of a computing system receiving a plurality of eventsin the form of event messages, each of at least some of the eventsaffecting one or more of a plurality of accounts; an act of thecomputing system partitioning each of the plurality of events into aplurality of channels, each of the plurality of channels receiving asubset of the plurality of events; and for at least one of the pluralityof channels, performing de-duplication for at least some of the eventsreceived by the corresponding channel, wherein de-duplication comprises:an act of performing a first process to determine that the first eventcannot be ruled out as being a duplicate of another event previouslyreceived by the channel; identifying a value of the first event; and anact of taking subsequent action, which is directed at determiningwhether the first event is a duplicate, based upon both of (1) thedetermination that the first event cannot be ruled out as being aduplicate, as well as (2) the value of the first event, wherein thesubsequent action comprises a first combination of processes when thevalue of the first event is a first value, and wherein the subsequentaction comprises a second combination of processes that is differentthan the first combination of processes when the value of the firstevent is a second value that is different than the first value.
 12. Thecomputer storage device of claim 11, wherein the computer-executableinstructions are further structured such that, when executed by the oneor more processors, the computing system treats the first event as aduplicate.
 13. The computer storage device of claim 12, wherein thecomputing system treats the first event as a duplicate by deleting thefirst event.
 14. The computer storage device of claim 12, wherein thecomputing system treats the first event as a duplicate by loggingdetection of a duplicate.
 15. The computer storage device of claim 11,wherein the computing system further searches identifiers for eventspreviously received by the channel until a duplicate identifier is foundcorresponding to the identifier of the first event.
 16. The computerstorage device of claim 15, wherein the computing system searches foridentifiers for events previously received by the channel by searching atime-ordered identifier index that contains an index of identifiers ofpreviously received events ordered by time.
 17. The computer storagedevice of claim 11, wherein the first process to determine that thefirst event cannot be ruled out as being a duplicate of another eventpreviously received by the channel includes comparing an eventidentifier for the first event against a particular filter and whereinthe de-duplication further comprises: comparing an event identifier fora second event against the particular filter to determine that thesecond event is not a duplicate of another event received by thecorresponding channel; in response to determining that the second eventis not a duplicate of another event, an act of updating the particularfilter to reflect receipt of the second event, wherein the second eventmay be received by the channel before or after the first event.
 18. Acomputing system comprising: one or more processor; and one or morestorage device having stored computer-executable instructions that, whenexecuted by the one or more processor, cause the computing system toimplement a method that includes: receiving a plurality of events in theform of event messages, each of at least some of the events affectingone or more of a plurality of accounts; partitioning each of theplurality of events into a plurality of channels, each of the pluralityof channels receiving a subset of the plurality of events; and for atleast one of the plurality of channels, performing de-duplication for atleast some of the events received by the corresponding channel, whereinde-duplication comprises: an act of performing an initial computingprocess to determine that the first event cannot be ruled out as being aduplicate of another event previously received by the channel, theinitial computing process including analyzing an event identifier forthe first event; identifying a value of the first event; and an act ofperforming a subsequent computing process, which is directed atdetermining whether the first event is a duplicate, based upon both of(1) the determination that the first event cannot be ruled out as beinga duplicate, as well as (2) the value of the first event, wherein thesubsequent computing process comprises a first combination of processeswhen the value of the first event is a first value, and wherein thesubsequent computing process comprises a second combination of processesthat is different than the first combination of processes when the valueof the first event is a second value.
 19. The system of claim 18,wherein the value comprises at least one of a financial value or animpact value on a financial billing that is associated with the incomingevents.
 20. The system of claim 18, wherein the initial computingprocess includes an act of comparing the event identifier for the firstevent against a first filter to determine that the first event cannot beruled out as being a duplicate.